You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
During cluster deployment, {product-title} requires a minimum bandwidth of 120{nbsp}Mbps between cluster infrastructure and the public internet or private network locations that provide deployment artifacts and resources. When network connectivity is slower than 120{nbsp}Mbps (for example, when connecting through a proxy) the cluster installation process times out and deployment fails.
10
+
During cluster deployment,
11
+
ifdef::openshift-rosa[]
12
+
{rosa-classic-short}
13
+
endif::openshift-rosa[]
14
+
ifdef::openshift-rosa-hcp[]
15
+
{rosa-short}
16
+
endif::openshift-rosa-hcp[]
17
+
requires a minimum bandwidth of 120{nbsp}Mbps between cluster infrastructure and the public internet or private network locations that provide deployment artifacts and resources. When network connectivity is slower than 120{nbsp}Mbps (for example, when connecting through a proxy) the cluster installation process times out and deployment fails.
11
18
12
19
After cluster deployment, network requirements are determined by your workload. However, a minimum bandwidth of 120{nbsp}Mbps helps to ensure timely cluster and operator upgrades.
Copy file name to clipboardExpand all lines: modules/rosa-hcp-firewall-prerequisites.adoc
+1-1Lines changed: 1 addition & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -8,7 +8,7 @@
8
8
[id="rosa-hcp-firewall-prerequisites_{context}"]
9
9
= Firewall prerequisites for {hcp-title}
10
10
11
-
* If you are using a firewall to control egress traffic from {hcp-title-first}, your Virtual Private Cloud (VPC) must be able to complete requests from the cluster to the Amazon S3 service, for example, via an Amazon S3 gateway.
11
+
* If you are using a firewall to control egress traffic from {rosa-title}, your Virtual Private Cloud (VPC) must be able to complete requests from the cluster to the Amazon S3 service, for example, via an Amazon S3 gateway.
12
12
13
13
* You must also configure your firewall to grant access to the following domain and port combinations.
14
14
//TODO OSDOCS-11789: From your deploy machine? From your cluster?
Copy file name to clipboardExpand all lines: modules/rosa-sts-aws-requirements-security-req.adoc
+4-1Lines changed: 4 additions & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -7,4 +7,7 @@
7
7
= Security requirements
8
8
//TODO OSDOCS-11789: Red Hat as in RHSRE? Red Hat as in RH services in the cluster?
9
9
* Red{nbsp}Hat must have ingress access to EC2 hosts and the API server from allow-listed IP addresses.
10
-
* Red{nbsp}Hat must have egress allowed to the domains documented in the "Firewall prerequisites" section. Clusters with {zero-egress} are exempt from this requirement.
10
+
* Red{nbsp}Hat must have egress allowed to the domains documented in the "Firewall prerequisites" section.
11
+
ifdef::openshift-rosa-hcp[]
12
+
Clusters with {egress-zero} are exempt from this requirement.
Copy file name to clipboardExpand all lines: modules/rosa-sts-aws-requirements-support-req.adoc
+8-1Lines changed: 8 additions & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -7,4 +7,11 @@
7
7
* Red{nbsp}Hat recommends that the customer have at least link:https://aws.amazon.com/premiumsupport/plans/[Business Support] from AWS.
8
8
* Red{nbsp}Hat may have permission from the customer to request AWS support on their behalf.
9
9
* Red{nbsp}Hat may have permission from the customer to request AWS resource limit increases on the customer's account.
10
-
* Red{nbsp}Hat manages the restrictions, limitations, expectations, and defaults for all {product-title} clusters in the same manner, unless otherwise specified in this requirements section.
10
+
* Red{nbsp}Hat manages the restrictions, limitations, expectations, and defaults for all
11
+
ifdef::openshift-rosa[]
12
+
{rosa-classic-short}
13
+
endif::openshift-rosa[]
14
+
ifdef::openshift-rosa-hcp[]
15
+
{rosa-short}
16
+
endif::openshift-rosa-hcp[]
17
+
clusters in the same manner, unless otherwise specified in this requirements section.
= Prerequisites checklist for deploying ROSA using STS
6
+
= Prerequisites checklist for deploying {rosa-classic-short} using STS
7
7
endif::[]
8
8
ifdef::openshift-rosa-hcp[]
9
-
= Prerequisites checklist for deploying ROSA with HCP
9
+
= Prerequisites checklist for deploying {rosa-short}
10
10
endif::openshift-rosa-hcp[]
11
11
12
12
toc::[]
@@ -23,13 +23,11 @@ toc::[]
23
23
// - Diana Sari
24
24
//---
25
25
26
-
This is a high level checklist of prerequisites needed to create a
26
+
This is a high level checklist of prerequisites needed to create a{product-title} cluster
27
27
ifdef::openshift-rosa[]
28
-
{rosa-classic-first} cluster with link:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html[STS].
28
+
with link:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html[STS]
29
29
endif::openshift-rosa[]
30
-
ifdef::openshift-rosa-hcp[]
31
-
{hcp-title-first} cluster.
32
-
endif::openshift-rosa-hcp[]
30
+
.
33
31
34
32
//TODO OSDOCS-11789: Consider adding the following to a subsection about the initiating/control machine, along with CLI sections?
35
33
The machine that you run the installation process from must have access to the following:
@@ -126,7 +124,14 @@ $ rosa whoami
126
124
127
125
=== OpenShift CLI (`oc`)
128
126
129
-
The OpenShift CLI (`oc`) is not required to deploy a {product-title} cluster, but is a useful tool for interacting with your cluster after it is deployed.
127
+
The OpenShift CLI (`oc`) is not required to deploy a
128
+
ifdef::openshift-rosa[]
129
+
{rosa-classic-short}
130
+
endif::openshift-rosa[]
131
+
ifdef::openshift-rosa-hcp[]
132
+
{rosa-short}
133
+
endif::openshift-rosa-hcp[]
134
+
cluster, but is a useful tool for interacting with your cluster after it is deployed.
130
135
131
136
. Download and install`oc` from the {cluster-manager} link:https://console.redhat.com/openshift/downloads#tool-oc[Command-line interface (CLI) tools] page, or follow the instructions in xref:../cli_reference/openshift_cli/getting-started-cli.adoc#cli-getting-started[Getting started with the OpenShift CLI].
132
137
. Verify that the OpenShift CLI has been installed correctly by running the following command:
@@ -148,20 +153,33 @@ $ rosa verify quota
148
153
+
149
154
This command only checks the total quota allocated to your account; it does not reflect the amount of quota already consumed from that quota. Running this command is optional because your quota is verified during cluster deployment. However, Red Hat recommends running this command to confirm your quota ahead of time so that deployment is not interrupted by issues with quota availability.
150
155
ifdef::openshift-rosa[]
151
-
* For more information about resources provisioned during ROSA cluster deployment, see xref:../rosa_planning/rosa-sts-aws-prereqs.adoc#rosa-aws-policy-provisioned_rosa-sts-aws-prereqs[Provisioned AWS Infrastructure].
156
+
* For more information about resources provisioned during {rosa-classic-short} cluster deployment, see xref:../rosa_planning/rosa-sts-aws-prereqs.adoc#rosa-aws-policy-provisioned_rosa-sts-aws-prereqs[Provisioned AWS Infrastructure].
152
157
* For more information about the required AWS service quotas, see xref:../rosa_planning/rosa-sts-required-aws-service-quotas.adoc#rosa-sts-required-aws-service-quotas[Required AWS service quotas].
153
158
endif::openshift-rosa[]
154
159
ifdef::openshift-rosa-hcp[]
155
-
* For more information about resources provisioned during ROSA cluster deployment, see xref:../rosa_planning/rosa-sts-aws-prereqs.adoc#rosa-aws-policy-provisioned_rosa-hcp-prereqs[Provisioned AWS Infrastructure].
160
+
* For more information about resources provisioned during {rosa-short} cluster deployment, see xref:../rosa_planning/rosa-sts-aws-prereqs.adoc#rosa-aws-policy-provisioned_rosa-hcp-prereqs[Provisioned AWS Infrastructure].
156
161
* For more information about the required AWS service quotas, see xref:../rosa_planning/rosa-sts-required-aws-service-quotas.adoc#rosa-sts-required-aws-service-quotas[Required AWS service quotas].
157
162
endif::openshift-rosa-hcp[]
158
163
159
164
== Service Control Policy (SCP) prerequisites
160
165
161
-
ROSA clusters are hosted in an AWS account within an AWS organizational unit. A link:https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html[service control policy (SCP)] is created and applied to the AWS organizational unit that manages what services the AWS sub-accounts are permitted to access.
166
+
ifdef::openshift-rosa[]
167
+
{rosa-classic-short}
168
+
endif::openshift-rosa[]
169
+
ifdef::openshift-rosa-hcp[]
170
+
{rosa-short}
171
+
endif::openshift-rosa-hcp[]
172
+
clusters are hosted in an AWS account within an AWS organizational unit. A link:https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html[service control policy (SCP)] is created and applied to the AWS organizational unit that manages what services the AWS sub-accounts are permitted to access.
162
173
163
174
* Ensure that your organization's SCPs are not more restrictive than the roles and policies required by the cluster. For more information, see the xref:../rosa_architecture/rosa-sts-about-iam-resources.adoc#rosa-minimum-scp_rosa-sts-about-iam-resources[Minimum set of effective permissions for SCPs].
164
-
* When you create a ROSA cluster, an associated AWS OpenID Connect (OIDC) identity provider is created.
175
+
* When you create a
176
+
ifdef::openshift-rosa[]
177
+
{rosa-classic-short}
178
+
endif::openshift-rosa[]
179
+
ifdef::openshift-rosa-hcp[]
180
+
{rosa-short}
181
+
endif::openshift-rosa-hcp[]
182
+
cluster, an associated AWS OpenID Connect (OIDC) identity provider is created.
165
183
166
184
== Networking prerequisites
167
185
@@ -182,7 +200,7 @@ endif::openshift-rosa-hcp[]
182
200
183
201
//Moving up prereqs that are actually required for deployment
184
202
ifdef::openshift-rosa[]
185
-
== VPC requirements for PrivateLink clusters
203
+
=== VPC requirements for PrivateLink clusters
186
204
187
205
If you choose to deploy a PrivateLink cluster, then be sure to deploy the cluster in the pre-existing BYO VPC:
You can configure a custom domain name server and custom domain name for your cluster. To do so, complete the following prerequisites before you create the cluster:
244
262
245
263
//TODO OSDOCS-11789: Needs verification from mmcneill
246
-
* By default, ROSA clusters require you to set the `domain name servers` option to `AmazonProvidedDNS` to ensure successful cluster creation and operation.
264
+
* By default,
265
+
ifdef::openshift-rosa[]
266
+
{rosa-classic-short}
267
+
endif::openshift-rosa[]
268
+
ifdef::openshift-rosa-hcp[]
269
+
{rosa-short}
270
+
endif::openshift-rosa-hcp[]
271
+
clusters require you to set the `domain name servers` option to `AmazonProvidedDNS` to ensure successful cluster creation and operation.
247
272
* To use a custom DNS server and domain name for your cluster, the ROSA installer must be able to use VPC DNS with default DHCP options so that it can resolve internal IPs and services. This means that you must create a custom DHCP option set to forward DNS lookups to your DNS server, and associate this option set with your VPC before you create the cluster.
248
273
ifdef::openshift-rosa[]
249
274
For more information, see xref:../cloud_experts_tutorials/cloud-experts-custom-dns-resolver.adoc#cloud-experts-custom-dns-resolver[Deploying ROSA with a custom DNS resolver].
* See xref:../rosa_architecture/rosa-sts-about-iam-resources.adoc#rosa-sts-account-wide-roles-and-policies_rosa-sts-about-iam-resources[Account-wide IAM role and policy reference] for a list of IAM roles needed for cluster creation.
84
+
* xref:../rosa_architecture/rosa-sts-about-iam-resources.adoc#rosa-sts-account-wide-roles-and-policies_rosa-sts-about-iam-resources[Account-wide IAM role and policy reference]
0 commit comments